1683 matches found
PT-2018-10222 · Coreos +3 · Etcd +3
Name of the Vulnerable Software and Affected Versions: etcd versions 3.3.1 and earlier Description: A cross-site request forgery flaw was found, allowing an attacker to set up a website that tries to send a POST request to the etcd server and modify a key. Since adding a key is done with PUT, it ...
Ajenti Input Validation Vulnerability
Ajenti is a Web-based open source server management system developed by Belarusian software developer Eugene Pankov. The system comes with a variety of pre-built plug-ins for configuring and monitoring server software and services such as Apache, scheduled tasks Cron and so on. An input validatio...
Debian: Security Advisory (DLA-1288-1)
The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
CVE-2017-18195
An issue was discovered in tools/conversations/viewajax.php in Concrete5 before 8.3.0. An unauthenticated user can enumerate comments from all blog posts by POSTing requests to /index.php/tools/required/conversations/viewajax with incremental 'cnvID' integers...
Cross site request forgery (csrf)
An issue was discovered in Userscape HelpSpot before 4.7.2. A cross-site request forgery vulnerability exists on POST requests to the "index.php?pg=password.change" endpoint. This allows an attacker to change the password of another user's HelpSpot account...
PT-2018-6330
Name of the Vulnerable Software and Affected Versions: Userscape HelpSpot versions prior to 4.7.2 Description: A cross-site request forgery issue exists, allowing an attacker to change the password of another user's account through POST requests to the "index.php?pg=password.change" endpoint...
DEBIAN-CVE-2017-18190
A localhost.localdomain whitelist entry in validhost in scheduler/client.c in CUPS before 2.2.2 allows remote attackers to execute arbitrary IPP commands by sending POST requests to the CUPS daemon in conjunction with DNS rebinding. The localhost.localdomain name is often resolved via a DNS serve...
CVE-2017-18190
A localhost.localdomain whitelist entry in validhost in scheduler/client.c in CUPS before 2.2.2 allows remote attackers to execute arbitrary IPP commands by sending POST requests to the CUPS daemon in conjunction with DNS rebinding. The localhost.localdomain name is often resolved via a DNS serve...
CVE-2017-18190
A localhost.localdomain whitelist entry in validhost in scheduler/client.c in CUPS before 2.2.2 allows remote attackers to execute arbitrary IPP commands by sending POST requests to the CUPS daemon in conjunction with DNS rebinding. The localhost.localdomain name is often resolved via a DNS serve...
Medium: transmission
Issue Overview: Transmission relies on X-Transmission-Session-Id which is not a forbidden header for Fetch for access control, which allows remote attackers to execute arbitrary RPC commands, and consequently write to arbitrary files, via POST requests to /transmission/rpc in conjunction with a D...
Cross-site Scripting (XSS)
global-build-stats is vulnerable to reflected cross-site scripting XSS attacks. These attacks are possible because some URLs return JSON as Content Type: text/html. This content may be interpreted by clients as HTML allowing XSS to be performed. Cross-site request forgery CSRF attacks are also...
Cross site request forgery (csrf)
Some URLs provided by Jenkins global-build-stats plugin version 1.4 and earlier returned a JSON response that contained request parameters. These responses had the Content Type: text/html, so could have been interpreted as HTML by clients, resulting in a potential reflected cross-site scripting...
Cross-site Request Forgery (CSRF)
The Jenkins Translation plugin is vulnerable to cross-site request forgery CSRF attacks. POST requests don't require a form submission to be submitted. Leveraging this, attackers can override localized strings displayed to all users when the victim is a Jenkins administrator...
Cross-site Request Forgery (CSRF)
Jenkins release plugin is vulnerable to cross-site request forgery CSRF attacks. These attacks are possible because the POST requests used to trigger builds do not require a form submission...
CVE-2018-5999
An issue was discovered in AsusWRT before 3.0.0.4.38410007. In the handlerequest function in router/httpd/httpd.c, processing of POST requests continues even if authentication fails...
Authentication flaw
An issue was discovered in AsusWRT before 3.0.0.4.38410007. In the handlerequest function in router/httpd/httpd.c, processing of POST requests continues even if authentication fails...
CVE-2018-5999
An issue was discovered in AsusWRT before 3.0.0.4.38410007. In the handlerequest function in router/httpd/httpd.c, processing of POST requests continues even if authentication fails...
CVE-2018-5999
An issue was discovered in AsusWRT before 3.0.0.4.38410007. In the handlerequest function in router/httpd/httpd.c, processing of POST requests continues even if authentication fails...
CVE-2018-5999
An issue was discovered in AsusWRT before 3.0.0.4.38410007. In the handlerequest function in router/httpd/httpd.c, processing of POST requests continues even if authentication fails...
CVE-2018-5999
Affected software: AsusWRT on Asus routers (firmware prior to 3.0.0.4.384_10007). Vulnerability: In handle_request() of router/httpd/httpd.c, processing of POST requests can continue after authentication fails, enabling unauthenticated access. Impact: Unauthenticated LAN remote code execution wit...